| name | analyzing-golang-malware-internals |
| description | Analyzes Go-compiled malware by recovering function names from the pclntab, detecting the Go build/version string, and listing embedded package paths to overcome stripped symbols. Activates for requests to analyze Go malware, recover Go function names, or identify a Golang binary build. |
| domain | cybersecurity |
| subdomain | reverse-engineering |
| tags | ["reverse-engineering","golang","symbol-recovery","pclntab","stripped-binaries"] |
| version | 1.0.0 |
| author | analyst-ai-pack |
| license | Apache-2.0 |
| mitre_attack | ["T1027","T1587.001","T1059"] |
| d3fend | ["D3-SDA","D3-DA"] |
| references | ["Go runtime pclntab format (Go source: runtime/symtab.go) — https://go.dev/src/runtime/symtab.go","Go binary build info (debug/buildinfo) — https://pkg.go.dev/debug/buildinfo"] |
Analyzing Golang Malware Internals
When to Use
- You have a Go-compiled binary (often large, statically linked) and standard symbol recovery
fails because user symbols are stripped.
- You need function names from the pclntab, the Go version, and embedded package/module paths.
Do not use this for non-Go binaries — confirm the Go build signature first. This skill reads
the binary statically and executes nothing.
Prerequisites
- The Go binary (read inertly).
Safety & Handling
- Read bytes statically; treat strings as untrusted data.
Workflow
Step 1: Confirm it is Go and get the version
python scripts/analyst.py info sample.bin
Looks for the Go build ID, the go1.x version string, and runtime. references.
Step 2: Recover function names from pclntab
The pclntab (preceded by a magic like \xfb\xff\xff\xff/\xf0\xff\xff\xff across Go versions)
contains function name strings; extract main.*, package-qualified, and runtime.* names.
Step 3: Enumerate package paths
List embedded import/module paths (github.com/..., vendored deps) to fingerprint capabilities
and third-party libraries.
Step 4: Map and document
Map suspicious packages (networking, crypto, exec) to behavior and ATT&CK.
Validation
- The Go build signature/version is confirmed before deeper parsing.
- Recovered names include plausible
main.*/package-qualified functions.
- Package paths are real module paths, not random strings.
Pitfalls
- pclntab magic differs across Go versions; try the known set.
- Obfuscators (garble) rename symbols and strip build info — names may be hashed.
- Confusing vendored library code with the author's
main package.
References
